Vulnerabilities
Fortra has patched a critical-severity vulnerability in FileCatalyst Workflow leading to the creation of administrator accounts.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
GitLab CE and EE updates resolve 14 vulnerabilities, including a critical- and three high-severity bugs.
Vulnerabilities
CISA on Wednesday warned that three older flaws in GeoServer, Linux kernel, and Roundcube webmail are exploited in the wild.
Vulnerabilities
Exploitation attempts targeting CVE-2024-5806, a critical MOVEit Transfer vulnerability patched recently, have started.
Ransomware
Researcher shows how hackers could use social engineering to deliver ransomware and other malware to Meta’s Quest 3 VR headset.
Vulnerabilities
Google has released a Chrome security update to resolve four high-severity use-after-free vulnerabilities.
Vulnerabilities
New attack named SnailLoad allows a remote attacker to infer websites and videos viewed by a user without direct access to network traffic.
Privacy
The EFF has issued a warning over the use of automated license plate readers following the discovery of serious vulnerabilities.
Vulnerabilities
Noteworthy stories that might have slipped under the radar: Microsoft email spoofing vulnerability, Snowflake hack victims get ransom demands, LogoFail still around.
Vulnerabilities
Threat actors are exploiting a recent path traversal vulnerability in SolarWinds Serv-U using public PoC code.
Vulnerabilities
Atlassian has released Confluence, Crucible, and Jira updates to address multiple high-severity vulnerabilities.
Vulnerabilities
Google has released a Chrome 126 security update with six fixes, including four for externally reported high-severity flaws.
Vulnerabilities
Serious vulnerabilities that can allow remote code execution and privilege escalation have been patched in VMware vCenter Server.
ICS/OT
Rockwell Automation has patched three high-severity vulnerabilities in its FactoryTalk View SE HMI software.
Funding/M&A
YesWeHack has raised more than $52 million to date to build and market a crowdsourced vulnerability reporting platform.
ICS/OT
Analysis and insights on the prevalence and impact of password exposure vulnerabilities in ICS and other OT products.
Malware & Threats
The zero-day is tagged as CVE-2024-32896 and described as an elevation of privilege issue in Pixel Firmware.
Vulnerabilities
Microsoft’s June 2024 Patch Tuesday updates resolve a zero-click Outlook vulnerability leading to remote code execution.
Vulnerabilities
Fortinet has patched multiple vulnerabilities in FortiOS, including a high-severity code execution security flaw.
Vulnerabilities
The code hosting platform GitHub has paid out more than $4 million since the launch of its bug bounty program 10 years ago.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)